So far we have only considered white noise and salt and pepper perturbations. We further consider adversarial perturbations. Here, we use projected gradient decent [1]} with 7 iterations and various \(\epsilon \)  levels to construct the adversarial perturbations. Fig. REF  highlights the improved resilience of ResNets trained with NFM to adversarial input perturbations. Fig. REF  shows results for CIFAR-10 (left) and CIFAR-100 (right). Models trained with both mixup and manifold mixup do not show a substantially increased resilience to adversarial perturbations.
